@clearly-hub/node 0.3.0 → 0.4.1

package/README.md

@@ -2,7 +2,8 @@
 
 Connect your web app to Clearly.HUB with a script, some config and one server handler. You get
 "Sign in with Clearly.HUB", the hosted screens (choose a plan, pick data, save a result, choose a
-hub) and each hub's subscription to your app. Tokens stay on your server.
+hub) and each hub's subscription to your app. The refresh token stays on your server; the page gets
+the access token only when it asks, for protected data.
 
 > **Preview (0.x).** The API may still change between minor versions. Proprietary: see
 > [LICENSE](LICENSE).
@@ -30,7 +31,7 @@ const hub = clearlyHub({
   m2mClientId: process.env.CLEARLY_HUB_M2M_CLIENT_ID,
   m2mClientSecret: process.env.CLEARLY_HUB_M2M_CLIENT_SECRET,
   appUrl: 'https://app.example.com',
-  secret: process.env.SESSION_SECRET, // 32+ characters
+  secret: process.env.SESSION_SECRET, // 32+ random characters
 });
 
 const app = express();
@@ -51,7 +52,9 @@ Hono, Bun or Deno. Mount it at `/clearly-hub/*`.
 
 <script type="module">
   const session = await clearlyHub.session(); // { signedIn, user }
-  window.addEventListener('clearly-hub-answer', (event) => console.log(event.detail));
+  window.addEventListener('clearly-hub-answer', (event) =>
+    console.log(event.detail),
+  );
 </script>
 ```
 
@@ -65,6 +68,7 @@ Or `npm install @clearly-hub/browser` and `import { clearlyHub } from '@clearly-
 | `clearlyHub.signIn()`, `signOut()`               | Go through Clearly.HUB and come back to this page                                                                                                          |
 | `clearlyHub.open(action, { data, display })`     | Opens a hosted screen; resolves with its checked answer. Call it from a click: browsers only allow popups there                                            |
 | `clearlyHub.result()`                            | After a redirect screen: its answer, on the page it came back to                                                                                           |
+| `clearlyHub.getToken()`                          | The person's key for protected and paid data, or `null` when signed out. See [Protected data](#protected-data)                                             |
 | `clearlyHub.onAnswer(callback)`                  | Every answer, once each, from a popup or after a redirect; also when you start listening after it arrived (React). Returns a function that stops listening |
 | `<clearly-hub-button action display data label>` | Branded button for `sign-in`, `sign-out` and each screen                                                                                                   |
 | `clearly-hub-answer` event                       | Every answer, from a popup or after a redirect                                                                                                             |
@@ -94,15 +98,34 @@ blocked popup falls back to a redirect.
 | `REGISTER_RESOURCE`   | `{ url, format }` of your result, at a public https URL | `activeHub`, `dataset`, `resource`                                                             |
 | `SELECT_HUB`          |                                                         | `hub` (`_id`, `name`)                                                                          |
 
+## Protected data
+
+A protected or paid resource from `DATA_PICKER` (`requiresToken: true`) has a `url` on Clearly.HUB,
+which checks the person's key on every request. Send it as the `Authorization` header. In the page:
+
+```js
+const response = await fetch(resource.url, {
+  headers: { Authorization: await clearlyHub.getToken() },
+});
+```
+
+Map layers (WMS, WMTS, tiles) load many URLs themselves: use a Leaflet, OpenLayers or Cesium option
+or plugin that adds headers to each request. The key lasts an hour; `getToken()` gets a new one in
+time, so call it again rather than keeping the value. On your server, `hub.fetchAsUser(req, url)`
+does the same.
+
+The key is the person's own Clearly.HUB key: send it only to resource URLs from `DATA_PICKER` (Clearly.HUB's
+data proxy), and keep scripts you don't trust off pages that use it. `fetchAsUser` refuses other URLs.
+
 ## The Node package
 
 |                                                        |                                                                                                                                                                                        |
 | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `hub.express()`, `hub.handler`                         | The routes: `/sign-in`, `/callback`, `/sign-out`, `/session`, `/open`, `/answer`, `/result`                                                                                            |
+| `hub.express()`, `hub.handler`                         | The routes: `/sign-in`, `/callback`, `/sign-out`, `/session`, `/open`, `/answer`, `/result`, `/token`                                                                                  |
 | `onSignIn(person, { request, req })`                   | Called after each sign-in. Return your own user id to keep it in the session, or `{ appUserId, redirectTo }` to also choose the next page                                              |
 | `onAnswer(result, { user, data, request, req })`       | Called with each checked answer before it reaches the browser, for example to set up a workspace. `data` is what the screen was sent; what you return reaches the page as `result.app` |
 | `hub.getUser(req)`                                     | Who's signed in, in your own routes                                                                                                                                                    |
-| `hub.fetchAsUser(req, url)`                            | Fetch protected or paid data (from `DATA_PICKER`) with the person's key                                                                                                                |
+| `hub.fetchAsUser(req, url)`                            | Fetch protected or paid data (from `DATA_PICKER`) on your server, with the person's key. Only URLs on Clearly.HUB's data proxy                                                         |
 | `hub.getSubscription(hubId)`, `getSubscriptions()`     | A hub's subscription to your app, or all of them                                                                                                                                       |
 | `hub.reportUsage({ request or sub, hubId, quantity })` | Report billable use; Clearly.HUB bills the hub. Pass `sub` for a Clearly.HUB account you stored, without a live sign-in                                                                |
 | `hub.getUserToken(req)`, `getAppToken()`               | The person's key and your app's key, for calls of your own                                                                                                                             |
@@ -121,18 +144,29 @@ const hub = clearlyHub<express.Request>({
 });
 ```
 
-**What it checks for you:** every screen answer's Ed25519 signature, and that it answers a screen
-opened in this browser, once (`state`). The session is encrypted in cookies, so there's nothing to
-store; it's split over several cookies because tokens are large.
+**What it checks for you:** every screen answer's Ed25519 signature, that it answers a screen
+opened in this browser, once (`state`), and that it was given to your app and that screen
+(`client_id`, callback URL, action).
+
+**What to trust in an answer:** it's a snapshot of the moment the person clicked. For access later,
+ask `getSubscription(hubId)` when it's used, not the `status` you got then. Ignore `answer.user`:
+Clearly.HUB doesn't check it yet. Who's signed in is the session's user.
+
+The session is encrypted in cookies, so there's nothing to store; it's split over several cookies
+because tokens are large. A copied cookie stays valid until its refresh token expires: signing out
+clears only this browser's copy.
 
-**Local Clearly.HUB:** pass `urls: { screens, api, usage, auth, issuer }`; see
+**Local Clearly.HUB:** pass `urls: { screens, api, proxy, auth, issuer }`; see
 `examples/express/.env.example`.
 
 ## Not covered (yet)
 
 - Setting up your own workspaces or tenants: do it by hand, with plans that need approval, or in
   `onAnswer` for `SELECT_SUBSCRIPTION`.
-- Other server languages: follow the Build checklist.
+- Other server languages (.NET, Python, ...): the browser package works with any
+  backend that answers the same routes. Contact us at
+  [support@futureinsight.nl](mailto:support@futureinsight.nl) and we'll help
+  you with yours.
 
 ## Working on this repo
 

package/dist/index.cjs

@@ -34,6 +34,23 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// ../shared/src/protocol.ts
+var DEFAULT_BASE_PATH = "/clearly-hub";
+var DEFAULT_HUB_URL = "https://hub.clearly.app";
+var DEFAULT_AUTH_URL = "https://auth.clearly.app";
+var DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
+var ROUTES = {
+  signIn: "/sign-in",
+  callback: "/callback",
+  signOut: "/sign-out",
+  session: "/session",
+  open: "/open",
+  answer: "/answer",
+  result: "/result",
+  token: "/token"
+};
+var ANSWER_CHANNEL = "clearly-hub-answers";
+
 // ../shared/src/screens.ts
 var SCREEN_ACTIONS = [
   "SELECT_SUBSCRIPTION",
@@ -62,22 +79,6 @@ function checkScreenData(action, data) {
   return void 0;
 }
 
-// ../shared/src/protocol.ts
-var DEFAULT_BASE_PATH = "/clearly-hub";
-var DEFAULT_HUB_URL = "https://hub.clearly.app";
-var DEFAULT_AUTH_URL = "https://auth.clearly.app";
-var DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
-var ROUTES = {
-  signIn: "/sign-in",
-  callback: "/callback",
-  signOut: "/sign-out",
-  session: "/session",
-  open: "/open",
-  answer: "/answer",
-  result: "/result"
-};
-var ANSWER_CHANNEL = "clearly-hub-answers";
-
 // src/config.ts
 var trimSlash = (url) => url.replace(/\/+$/, "");
 function resolveConfig(options) {
@@ -89,6 +90,7 @@ function resolveConfig(options) {
   const appUrl = trimSlash(options.appUrl);
   const hubUrl = trimSlash(options.hubUrl ?? DEFAULT_HUB_URL);
   const api = trimSlash(options.urls?.api ?? hubUrl);
+  const proxy = trimSlash(options.urls?.proxy ?? hubUrl);
   return {
     clientId: options.clientId,
     m2mClientId: options.m2mClientId,
@@ -100,7 +102,8 @@ function resolveConfig(options) {
     urls: {
       screens: trimSlash(options.urls?.screens ?? `${hubUrl}/components`),
       api,
-      usage: options.urls?.usage ?? `${hubUrl}/register-usage`,
+      proxy,
+      usage: options.urls?.usage ?? `${proxy}/register-usage`,
       publicKey: options.urls?.publicKey ?? `${api}/.well-known/public-key.pem`,
       auth: trimSlash(options.urls?.auth ?? DEFAULT_AUTH_URL),
       issuer: options.urls?.issuer ?? DEFAULT_ISSUER
@@ -120,11 +123,15 @@ function toNodeMiddleware(handle, appUrl) {
     try {
       const headers = new Headers();
       for (const [name, value] of Object.entries(req.headers)) {
-        if (Array.isArray(value)) value.forEach((item) => headers.append(name, item));
+        if (Array.isArray(value))
+          value.forEach((item) => headers.append(name, item));
         else if (value !== void 0) headers.set(name, value);
       }
       const url = new URL(req.originalUrl ?? req.url ?? "/", appUrl);
-      const response = await handle(new Request(url, { method: req.method, headers }), req);
+      const response = await handle(
+        new Request(url, { method: req.method, headers }),
+        req
+      );
       if (response.headers.get("X-Clearly-Hub") === "unhandled" && next) {
         next();
         return;
@@ -178,16 +185,24 @@ var Screens = class {
       base64Decode(signature),
       new TextEncoder().encode(data)
     );
-    if (!isSigned) throw new AnswerError("This answer was not signed by Clearly.HUB");
-    const { request, response } = JSON.parse(new TextDecoder().decode(base64Decode(data)));
-    return { state: request.state, response };
+    if (!isSigned)
+      throw new AnswerError("This answer was not signed by Clearly.HUB");
+    const { request, response } = JSON.parse(
+      new TextDecoder().decode(base64Decode(data))
+    );
+    return { request: request ?? {}, response };
   }
   // Fetched once; a key change needs a restart
   getPublicKey() {
     this.publicKey ??= this.config.fetch(this.config.urls.publicKey).then((response) => {
-      if (!response.ok) throw new Error(`No public key at ${this.config.urls.publicKey}`);
+      if (!response.ok)
+        throw new Error(`No public key at ${this.config.urls.publicKey}`);
       return response.text();
-    }).then((pem) => crypto.subtle.importKey("spki", pemToDer(pem), "Ed25519", false, ["verify"])).catch((error) => {
+    }).then(
+      (pem) => crypto.subtle.importKey("spki", pemToDer(pem), "Ed25519", false, [
+        "verify"
+      ])
+    ).catch((error) => {
       this.publicKey = void 0;
       throw error;
     });
@@ -198,7 +213,8 @@ var AnswerError = class extends Error {
 };
 function toScreenResult(action, response) {
   const { result, ...answer } = response;
-  if (result === "SUCCESS") return { action, result: "SUCCESS", answer };
+  if (result === "SUCCESS")
+    return { action, result: "SUCCESS", answer };
   return { action, result: result === "FAILURE" ? "FAILURE" : "CANCELLED" };
 }
 function base64Encode(text) {
@@ -214,7 +230,11 @@ function readRawQuery(url) {
   const params = /* @__PURE__ */ new Map();
   for (const pair of url.search.slice(1).split("&")) {
     const index = pair.indexOf("=");
-    if (index > 0) params.set(pair.slice(0, index), decodeURIComponent(pair.slice(index + 1)));
+    if (index > 0)
+      params.set(
+        pair.slice(0, index),
+        decodeURIComponent(pair.slice(index + 1))
+      );
   }
   return params;
 }
@@ -228,7 +248,8 @@ function createHandler(parts) {
     const url = new URL(request.url);
     if (!url.pathname.startsWith(config.basePath)) return notFound();
     const route = url.pathname.slice(config.basePath.length) || "/";
-    if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+    if (request.method !== "GET")
+      return new Response("Method not allowed", { status: 405 });
     const host = request.headers.get("host");
     const appHost = new URL(config.appUrl).host;
     if (host && host !== appHost && (route === ROUTES.signIn || route === ROUTES.open)) {
@@ -241,8 +262,12 @@ function createHandler(parts) {
       response = await routeRequest(route, url, data, parts, { request, req });
     } catch (error) {
       const isRefusedAnswer = error instanceof AnswerError;
-      if (!isRefusedAnswer) console.error(`Clearly.HUB: ${route} failed:`, error);
-      response = errorPage(isRefusedAnswer ? 400 : 500, describeError(error));
+      if (!isRefusedAnswer)
+        console.error(`Clearly.HUB: ${route} failed:`, error);
+      response = isRefusedAnswer ? errorPage(400, error.message) : errorPage(
+        500,
+        config.isSecure ? "Something went wrong with Clearly.HUB. Please try again." : describeError(error)
+      );
     }
     if (JSON.stringify(data) !== before) {
       for (const cookie of await sessions.write(data, chunkCount)) {
@@ -259,7 +284,8 @@ async function routeRequest(route, url, session, parts, incoming) {
     case ROUTES.callback:
       return finishSignIn(url, session, parts, incoming);
     case ROUTES.signOut:
-      for (const key of Object.keys(session)) delete session[key];
+      for (const key of Object.keys(session))
+        delete session[key];
       return redirect(parts.signIn.signOutUrl());
     case ROUTES.session:
       return json(await readSession(session, parts));
@@ -272,12 +298,16 @@ async function routeRequest(route, url, session, parts, incoming) {
       delete session.result;
       return json(result);
     }
+    case ROUTES.token:
+      return readToken(session, parts);
     default:
       return notFound();
   }
 }
 async function startSignIn(url, session, { config, signIn }) {
-  const { url: authorizationUrl, pending } = await signIn.start(safeReturnTo(url, config));
+  const { url: authorizationUrl, pending } = await signIn.start(
+    safeReturnTo(url, config)
+  );
   session.signIn = pending;
   return redirect(authorizationUrl);
 }
@@ -291,13 +321,28 @@ async function finishSignIn(url, session, { config, signIn }, incoming) {
   const { appUserId, redirectTo } = typeof decision === "string" ? { appUserId: decision, redirectTo: void 0 } : decision ?? {};
   session.user = { ...person, appUserId };
   session.tokens = tokens;
-  return redirect(`${config.appUrl}${safePath(redirectTo, config) ?? pending.returnTo}`);
+  return redirect(
+    `${config.appUrl}${safePath(redirectTo, config) ?? pending.returnTo}`
+  );
 }
 async function readSession(session, parts) {
   const accessToken = await getFreshAccessToken(session, parts);
   if (!session.user || !accessToken) return { signedIn: false };
   return { signedIn: true, user: session.user };
 }
+async function readToken(session, parts) {
+  const accessToken = await getFreshAccessToken(session, parts);
+  if (!session.user || !accessToken)
+    return json({ error: "Nobody is signed in with Clearly.HUB" }, 401);
+  const token = {
+    accessToken,
+    expiresIn: Math.max(
+      0,
+      session.tokens.expiresAt - Math.floor(Date.now() / 1e3)
+    )
+  };
+  return json(token);
+}
 async function getFreshAccessToken(session, { signIn }) {
   const tokens = session.tokens;
   if (!tokens) return void 0;
@@ -314,7 +359,8 @@ async function getFreshAccessToken(session, { signIn }) {
 }
 function openScreen(url, session, { config, screens }) {
   const action = url.searchParams.get("action");
-  if (!isScreenAction(action)) return errorPage(400, `Unknown screen: ${action}`);
+  if (!isScreenAction(action))
+    return errorPage(400, `Unknown screen: ${action}`);
   const display = url.searchParams.get("display") === "redirect" ? "redirect" : "popup";
   const dataParam = url.searchParams.get("data");
   let data;
@@ -339,15 +385,21 @@ function openScreen(url, session, { config, screens }) {
 }
 async function receiveAnswer(url, session, { config, screens }, incoming) {
   const query = readRawQuery(url);
-  const { state, response } = await screens.readAnswer(
+  const { request, response } = await screens.readAnswer(
     query.get("data") ?? "",
     query.get("signature") ?? ""
   );
+  const state = request.state;
   const pending = state ? session.screens?.[state] : void 0;
   if (!pending || Date.now() - pending.createdAt > SCREEN_TTL_MS) {
-    throw new AnswerError("This answer does not belong to a screen opened in this browser");
+    throw new AnswerError(
+      "This answer does not belong to a screen opened in this browser"
+    );
   }
   delete session.screens[state];
+  if (request.client_id !== config.clientId || request.redirect_url !== screens.answerUrl || request.actions?.length !== 1 || request.actions[0] !== pending.action) {
+    throw new AnswerError("This answer was given to another app or screen");
+  }
   let result = toScreenResult(pending.action, response);
   try {
     const app = await config.onAnswer?.(result, {
@@ -357,7 +409,11 @@ async function receiveAnswer(url, session, { config, screens }, incoming) {
     });
     if (app !== void 0) result = { ...result, app };
   } catch (error) {
-    result = { action: pending.action, result: "FAILURE", error: error.message };
+    result = {
+      action: pending.action,
+      result: "FAILURE",
+      error: error.message
+    };
   }
   if (pending.display === "redirect") {
     session.result = { ref: pending.ref, result };
@@ -392,11 +448,21 @@ function safePath(path, config) {
   }
 }
 var redirect = (location) => new Response(null, { status: 302, headers: { Location: location } });
-var json = (body) => new Response(JSON.stringify(body), {
-  headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+var json = (body, status = 200) => new Response(JSON.stringify(body), {
+  status,
+  headers: {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  }
+});
+var html = (body, status = 200) => new Response(body, {
+  status,
+  headers: { "Content-Type": "text/html; charset=utf-8" }
+});
+var notFound = () => new Response("Not found", {
+  status: 404,
+  headers: { "X-Clearly-Hub": "unhandled" }
 });
-var html = (body, status = 200) => new Response(body, { status, headers: { "Content-Type": "text/html; charset=utf-8" } });
-var notFound = () => new Response("Not found", { status: 404, headers: { "X-Clearly-Hub": "unhandled" } });
 function describeError(error) {
   const messages = [];
   for (let current = error; current instanceof Error && messages.length < 5; current = current.cause) {
@@ -405,7 +471,10 @@ function describeError(error) {
   return messages.join(": ") || String(error);
 }
 function errorPage(status, message) {
-  const escaped = message.replace(/[&<>"]/g, (char) => `&#${char.charCodeAt(0)};`);
+  const escaped = message.replace(
+    /[&<>"]/g,
+    (char) => `&#${char.charCodeAt(0)};`
+  );
   return html(
     `<!doctype html><meta charset="utf-8"><title>Clearly.HUB</title><p>${escaped}</p>`,
     status
@@ -427,7 +496,9 @@ var HubApi = class {
     try {
       return await this.config.fetch(url, init);
     } catch (error) {
-      throw new Error(`Clearly.HUB could not be reached at ${url}`, { cause: error });
+      throw new Error(`Clearly.HUB could not be reached at ${url}`, {
+        cause: error
+      });
     }
   }
   get hasAppKey() {
@@ -437,11 +508,16 @@ var HubApi = class {
   // until shortly before it expires
   async getAppToken() {
     const now = Date.now() / 1e3;
-    if (this.appToken && this.appToken.expiresAt > now + 60) return this.appToken.value;
+    if (this.appToken && this.appToken.expiresAt > now + 60)
+      return this.appToken.value;
     if (!this.hasAppKey) {
-      throw new Error("Clearly.HUB: m2mClientId and m2mClientSecret are needed for this");
+      throw new Error(
+        "Clearly.HUB: m2mClientId and m2mClientSecret are needed for this"
+      );
     }
-    const credentials = btoa(`${this.config.m2mClientId}:${this.config.m2mClientSecret}`);
+    const credentials = btoa(
+      `${this.config.m2mClientId}:${this.config.m2mClientSecret}`
+    );
     const response = await this.call(`${this.config.urls.auth}/oauth2/token`, {
       method: "POST",
       headers: {
@@ -457,7 +533,10 @@ var HubApi = class {
       throw new Error(`Clearly.HUB refused the app's key (${response.status})`);
     }
     const body = await response.json();
-    this.appToken = { value: body.access_token, expiresAt: now + body.expires_in };
+    this.appToken = {
+      value: body.access_token,
+      expiresAt: now + body.expires_in
+    };
     return body.access_token;
   }
   // Every hub that bought your app, with status and your plan id
@@ -465,11 +544,16 @@ var HubApi = class {
     if (this.subscriptions && Date.now() - this.subscriptions.fetchedAt < SUBSCRIPTIONS_CACHE_MS) {
       return this.subscriptions.value;
     }
-    const response = await this.call(`${this.config.urls.api}/api/app-api/subscriptions`, {
-      headers: { Authorization: `Bearer ${await this.getAppToken()}` }
-    });
+    const response = await this.call(
+      `${this.config.urls.api}/api/app-api/subscriptions`,
+      {
+        headers: { Authorization: `Bearer ${await this.getAppToken()}` }
+      }
+    );
     if (!response.ok) {
-      throw new Error(`Could not read the subscriptions from Clearly.HUB (${response.status})`);
+      throw new Error(
+        `Could not read the subscriptions from Clearly.HUB (${response.status})`
+      );
     }
     const items = await response.json();
     const value = items.map((item) => ({
@@ -502,12 +586,16 @@ var HubApi = class {
     });
     if (!response.ok) {
       const body = await response.json().catch(() => ({}));
-      throw new Error(`Clearly.HUB did not accept the usage: ${body.message ?? response.status}`);
+      throw new Error(
+        `Clearly.HUB did not accept the usage: ${body.message ?? response.status}`
+      );
     }
   }
 };
 function pickSubscription(subscriptions, hubId) {
-  const ofHub = subscriptions.filter((subscription) => subscription.hubId === hubId);
+  const ofHub = subscriptions.filter(
+    (subscription) => subscription.hubId === hubId
+  );
   return ofHub.find((s) => s.status === "ACTIVE") ?? ofHub.find((s) => s.status === "PENDING");
 }
 
@@ -524,7 +612,12 @@ var SignIn = class {
   }
   // Discovery happens once, on the first sign-in
   getConfiguration() {
-    this.configuration ??= oidc.discovery(new URL(this.config.urls.issuer), this.config.clientId, void 0, oidc.None()).catch((error) => {
+    this.configuration ??= oidc.discovery(
+      new URL(this.config.urls.issuer),
+      this.config.clientId,
+      void 0,
+      oidc.None()
+    ).catch((error) => {
       this.configuration = void 0;
       throw error;
     });
@@ -546,11 +639,15 @@ var SignIn = class {
     return { url: url.href, pending: { codeVerifier, state, nonce, returnTo } };
   }
   async finish(currentUrl, pending) {
-    const tokens = await oidc.authorizationCodeGrant(await this.getConfiguration(), currentUrl, {
-      pkceCodeVerifier: pending.codeVerifier,
-      expectedState: pending.state,
-      expectedNonce: pending.nonce
-    });
+    const tokens = await oidc.authorizationCodeGrant(
+      await this.getConfiguration(),
+      currentUrl,
+      {
+        pkceCodeVerifier: pending.codeVerifier,
+        expectedState: pending.state,
+        expectedNonce: pending.nonce
+      }
+    );
     const claims = tokens.claims();
     if (!claims) throw new Error("Clearly.HUB sent no ID token");
     return {
@@ -563,7 +660,10 @@ var SignIn = class {
     };
   }
   async refresh(refreshToken) {
-    const tokens = await oidc.refreshTokenGrant(await this.getConfiguration(), refreshToken);
+    const tokens = await oidc.refreshTokenGrant(
+      await this.getConfiguration(),
+      refreshToken
+    );
     return toSessionTokens(tokens, refreshToken);
   }
   // Signing out of Clearly.HUB too, or the next sign-in goes straight through
@@ -596,12 +696,16 @@ function parseCookies(header) {
   const cookies = /* @__PURE__ */ new Map();
   for (const part of header.split(";")) {
     const index = part.indexOf("=");
-    if (index > 0) cookies.set(part.slice(0, index).trim(), part.slice(index + 1).trim());
+    if (index > 0)
+      cookies.set(part.slice(0, index).trim(), part.slice(index + 1).trim());
   }
   return cookies;
 }
 async function deriveKey(secret) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
   return new Uint8Array(digest);
 }
 var SessionStore = class {
@@ -619,8 +723,14 @@ var SessionStore = class {
     }
     if (!chunks.length) return { data: {}, chunkCount: 0 };
     try {
-      const { plaintext } = await (0, import_jose.compactDecrypt)(chunks.join(""), await this.keyPromise);
-      return { data: JSON.parse(new TextDecoder().decode(plaintext)), chunkCount: chunks.length };
+      const { plaintext } = await (0, import_jose.compactDecrypt)(
+        chunks.join(""),
+        await this.keyPromise
+      );
+      return {
+        data: JSON.parse(new TextDecoder().decode(plaintext)),
+        chunkCount: chunks.length
+      };
     } catch {
       return { data: {}, chunkCount: chunks.length };
     }
@@ -628,7 +738,9 @@ var SessionStore = class {
   // Set-Cookie headers for the new session, clearing chunks it no longer needs
   async write(data, previousChunkCount) {
     const isEmpty = Object.keys(data).length === 0;
-    const chunks = isEmpty ? [] : (await this.encrypt(data)).match(new RegExp(`.{1,${CHUNK_SIZE}}`, "g"));
+    const chunks = isEmpty ? [] : (await this.encrypt(data)).match(
+      new RegExp(`.{1,${CHUNK_SIZE}}`, "g")
+    );
     const attributes = `Path=/; HttpOnly; SameSite=Lax${this.config.isSecure ? "; Secure" : ""}`;
     const headers = chunks.map(
       (chunk, i) => `${COOKIE_NAME}.${i}=${chunk}; Max-Age=${MAX_AGE_SECONDS}; ${attributes}`
@@ -675,10 +787,17 @@ function clearlyHub(options) {
     },
     getUserToken,
     // Fetch protected or paid data (for example from DATA_PICKER) with the
-    // person's key. Open data works without it.
+    // person's key. Open data works without it. Only URLs on Clearly.HUB's
+    // data proxy: the key would let anyone else act as this person
     async fetchAsUser(request, url, init = {}) {
+      if (!isOnProxy(url, config.urls.proxy)) {
+        throw new Error(
+          `Clearly.HUB: fetchAsUser only sends the person's key to Clearly.HUB's data proxy (${config.urls.proxy}, set with urls.proxy), not to ${url}`
+        );
+      }
       const token = await getUserToken(request);
-      if (!token) throw new Error("Clearly.HUB: nobody is signed in with Clearly.HUB");
+      if (!token)
+        throw new Error("Clearly.HUB: nobody is signed in with Clearly.HUB");
       const headers = new Headers(init.headers);
       headers.set("Authorization", token);
       return config.fetch(url, { ...init, headers });
@@ -703,11 +822,18 @@ function clearlyHub(options) {
     }) {
       const person = sub ?? (request && (await parts.sessions.read(request)).data.user?.sub);
       if (!person) {
-        throw new Error("Clearly.HUB: reportUsage needs the sub of a Clearly.HUB account");
+        throw new Error(
+          "Clearly.HUB: reportUsage needs the sub of a Clearly.HUB account"
+        );
       }
-      const subscription = pickSubscription(await parts.api.getSubscriptions(), hubId);
+      const subscription = pickSubscription(
+        await parts.api.getSubscriptions(),
+        hubId
+      );
       if (subscription?.status !== "ACTIVE") {
-        throw new Error(`Clearly.HUB: hub ${hubId} has no active subscription to your app`);
+        throw new Error(
+          `Clearly.HUB: hub ${hubId} has no active subscription to your app`
+        );
       }
       await parts.api.reportUsage({
         sub: person,
@@ -718,6 +844,15 @@ function clearlyHub(options) {
     }
   };
 }
+function isOnProxy(url, proxy) {
+  try {
+    const target = new URL(url);
+    const base = new URL(`${proxy}/`);
+    return target.origin === base.origin && target.pathname.startsWith(base.pathname);
+  } catch {
+    return false;
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   clearlyHub

package/dist/index.d.cts

@@ -71,6 +71,26 @@ type ScreenResult<A extends ScreenAction = ScreenAction> = {
     app?: unknown;
 };
 
+declare const DEFAULT_BASE_PATH = "/clearly-hub";
+declare const DEFAULT_HUB_URL = "https://hub.clearly.app";
+declare const DEFAULT_AUTH_URL = "https://auth.clearly.app";
+declare const DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
+declare const ROUTES: {
+    readonly signIn: "/sign-in";
+    readonly callback: "/callback";
+    readonly signOut: "/sign-out";
+    readonly session: "/session";
+    readonly open: "/open";
+    readonly answer: "/answer";
+    readonly result: "/result";
+    readonly token: "/token";
+};
+declare const ANSWER_CHANNEL = "clearly-hub-answers";
+interface AnswerMessage {
+    ref: string;
+    result: ScreenResult;
+}
+
 interface SessionUser {
     sub: string;
     email: string;
@@ -89,24 +109,9 @@ type Session = {
     signedIn: true;
     user: SessionUser;
 };
-
-declare const DEFAULT_BASE_PATH = "/clearly-hub";
-declare const DEFAULT_HUB_URL = "https://hub.clearly.app";
-declare const DEFAULT_AUTH_URL = "https://auth.clearly.app";
-declare const DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
-declare const ROUTES: {
-    readonly signIn: "/sign-in";
-    readonly callback: "/callback";
-    readonly signOut: "/sign-out";
-    readonly session: "/session";
-    readonly open: "/open";
-    readonly answer: "/answer";
-    readonly result: "/result";
-};
-declare const ANSWER_CHANNEL = "clearly-hub-answers";
-interface AnswerMessage {
-    ref: string;
-    result: ScreenResult;
+interface AccessToken {
+    accessToken: string;
+    expiresIn: number;
 }
 
 interface SignedInPerson {
@@ -143,6 +148,7 @@ interface ClearlyHubOptions<Req = unknown> {
 interface ClearlyHubUrls {
     screens: string;
     api: string;
+    proxy: string;
     usage: string;
     publicKey: string;
     auth: string;
@@ -179,4 +185,4 @@ declare function clearlyHub<Req = unknown>(options: ClearlyHubOptions<Req>): {
 type ClearlyHub = ReturnType<typeof clearlyHub>;
 
 export { ANSWER_CHANNEL, DEFAULT_AUTH_URL, DEFAULT_BASE_PATH, DEFAULT_HUB_URL, DEFAULT_ISSUER, ROUTES, SCREEN_ACTIONS, checkScreenData, clearlyHub, isScreenAction };
-export type { AnswerContext, AnswerMessage, AppSubscription, ClearlyHub, ClearlyHubOptions, ClearlyHubUrls, CookieSource, HookContext, HubRef, HubSubscription, PickedResource, ScreenAction, ScreenAnswers, ScreenData, ScreenDisplay, ScreenResult, Session, SessionUser, SignInDecision, SignedInPerson };
+export type { AccessToken, AnswerContext, AnswerMessage, AppSubscription, ClearlyHub, ClearlyHubOptions, ClearlyHubUrls, CookieSource, HookContext, HubRef, HubSubscription, PickedResource, ScreenAction, ScreenAnswers, ScreenData, ScreenDisplay, ScreenResult, Session, SessionUser, SignInDecision, SignedInPerson };

package/dist/index.d.ts

@@ -71,6 +71,26 @@ type ScreenResult<A extends ScreenAction = ScreenAction> = {
     app?: unknown;
 };
 
+declare const DEFAULT_BASE_PATH = "/clearly-hub";
+declare const DEFAULT_HUB_URL = "https://hub.clearly.app";
+declare const DEFAULT_AUTH_URL = "https://auth.clearly.app";
+declare const DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
+declare const ROUTES: {
+    readonly signIn: "/sign-in";
+    readonly callback: "/callback";
+    readonly signOut: "/sign-out";
+    readonly session: "/session";
+    readonly open: "/open";
+    readonly answer: "/answer";
+    readonly result: "/result";
+    readonly token: "/token";
+};
+declare const ANSWER_CHANNEL = "clearly-hub-answers";
+interface AnswerMessage {
+    ref: string;
+    result: ScreenResult;
+}
+
 interface SessionUser {
     sub: string;
     email: string;
@@ -89,24 +109,9 @@ type Session = {
     signedIn: true;
     user: SessionUser;
 };
-
-declare const DEFAULT_BASE_PATH = "/clearly-hub";
-declare const DEFAULT_HUB_URL = "https://hub.clearly.app";
-declare const DEFAULT_AUTH_URL = "https://auth.clearly.app";
-declare const DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
-declare const ROUTES: {
-    readonly signIn: "/sign-in";
-    readonly callback: "/callback";
-    readonly signOut: "/sign-out";
-    readonly session: "/session";
-    readonly open: "/open";
-    readonly answer: "/answer";
-    readonly result: "/result";
-};
-declare const ANSWER_CHANNEL = "clearly-hub-answers";
-interface AnswerMessage {
-    ref: string;
-    result: ScreenResult;
+interface AccessToken {
+    accessToken: string;
+    expiresIn: number;
 }
 
 interface SignedInPerson {
@@ -143,6 +148,7 @@ interface ClearlyHubOptions<Req = unknown> {
 interface ClearlyHubUrls {
     screens: string;
     api: string;
+    proxy: string;
     usage: string;
     publicKey: string;
     auth: string;
@@ -179,4 +185,4 @@ declare function clearlyHub<Req = unknown>(options: ClearlyHubOptions<Req>): {
 type ClearlyHub = ReturnType<typeof clearlyHub>;
 
 export { ANSWER_CHANNEL, DEFAULT_AUTH_URL, DEFAULT_BASE_PATH, DEFAULT_HUB_URL, DEFAULT_ISSUER, ROUTES, SCREEN_ACTIONS, checkScreenData, clearlyHub, isScreenAction };
-export type { AnswerContext, AnswerMessage, AppSubscription, ClearlyHub, ClearlyHubOptions, ClearlyHubUrls, CookieSource, HookContext, HubRef, HubSubscription, PickedResource, ScreenAction, ScreenAnswers, ScreenData, ScreenDisplay, ScreenResult, Session, SessionUser, SignInDecision, SignedInPerson };
+export type { AccessToken, AnswerContext, AnswerMessage, AppSubscription, ClearlyHub, ClearlyHubOptions, ClearlyHubUrls, CookieSource, HookContext, HubRef, HubSubscription, PickedResource, ScreenAction, ScreenAnswers, ScreenData, ScreenDisplay, ScreenResult, Session, SessionUser, SignInDecision, SignedInPerson };

package/dist/index.js

@@ -1,3 +1,20 @@
+// ../shared/src/protocol.ts
+var DEFAULT_BASE_PATH = "/clearly-hub";
+var DEFAULT_HUB_URL = "https://hub.clearly.app";
+var DEFAULT_AUTH_URL = "https://auth.clearly.app";
+var DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
+var ROUTES = {
+  signIn: "/sign-in",
+  callback: "/callback",
+  signOut: "/sign-out",
+  session: "/session",
+  open: "/open",
+  answer: "/answer",
+  result: "/result",
+  token: "/token"
+};
+var ANSWER_CHANNEL = "clearly-hub-answers";
+
 // ../shared/src/screens.ts
 var SCREEN_ACTIONS = [
   "SELECT_SUBSCRIPTION",
@@ -26,22 +43,6 @@ function checkScreenData(action, data) {
   return void 0;
 }
 
-// ../shared/src/protocol.ts
-var DEFAULT_BASE_PATH = "/clearly-hub";
-var DEFAULT_HUB_URL = "https://hub.clearly.app";
-var DEFAULT_AUTH_URL = "https://auth.clearly.app";
-var DEFAULT_ISSUER = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_1fM1Zd9mJ";
-var ROUTES = {
-  signIn: "/sign-in",
-  callback: "/callback",
-  signOut: "/sign-out",
-  session: "/session",
-  open: "/open",
-  answer: "/answer",
-  result: "/result"
-};
-var ANSWER_CHANNEL = "clearly-hub-answers";
-
 // src/config.ts
 var trimSlash = (url) => url.replace(/\/+$/, "");
 function resolveConfig(options) {
@@ -53,6 +54,7 @@ function resolveConfig(options) {
   const appUrl = trimSlash(options.appUrl);
   const hubUrl = trimSlash(options.hubUrl ?? DEFAULT_HUB_URL);
   const api = trimSlash(options.urls?.api ?? hubUrl);
+  const proxy = trimSlash(options.urls?.proxy ?? hubUrl);
   return {
     clientId: options.clientId,
     m2mClientId: options.m2mClientId,
@@ -64,7 +66,8 @@ function resolveConfig(options) {
     urls: {
       screens: trimSlash(options.urls?.screens ?? `${hubUrl}/components`),
       api,
-      usage: options.urls?.usage ?? `${hubUrl}/register-usage`,
+      proxy,
+      usage: options.urls?.usage ?? `${proxy}/register-usage`,
       publicKey: options.urls?.publicKey ?? `${api}/.well-known/public-key.pem`,
       auth: trimSlash(options.urls?.auth ?? DEFAULT_AUTH_URL),
       issuer: options.urls?.issuer ?? DEFAULT_ISSUER
@@ -84,11 +87,15 @@ function toNodeMiddleware(handle, appUrl) {
     try {
       const headers = new Headers();
       for (const [name, value] of Object.entries(req.headers)) {
-        if (Array.isArray(value)) value.forEach((item) => headers.append(name, item));
+        if (Array.isArray(value))
+          value.forEach((item) => headers.append(name, item));
         else if (value !== void 0) headers.set(name, value);
       }
       const url = new URL(req.originalUrl ?? req.url ?? "/", appUrl);
-      const response = await handle(new Request(url, { method: req.method, headers }), req);
+      const response = await handle(
+        new Request(url, { method: req.method, headers }),
+        req
+      );
       if (response.headers.get("X-Clearly-Hub") === "unhandled" && next) {
         next();
         return;
@@ -142,16 +149,24 @@ var Screens = class {
       base64Decode(signature),
       new TextEncoder().encode(data)
     );
-    if (!isSigned) throw new AnswerError("This answer was not signed by Clearly.HUB");
-    const { request, response } = JSON.parse(new TextDecoder().decode(base64Decode(data)));
-    return { state: request.state, response };
+    if (!isSigned)
+      throw new AnswerError("This answer was not signed by Clearly.HUB");
+    const { request, response } = JSON.parse(
+      new TextDecoder().decode(base64Decode(data))
+    );
+    return { request: request ?? {}, response };
   }
   // Fetched once; a key change needs a restart
   getPublicKey() {
     this.publicKey ??= this.config.fetch(this.config.urls.publicKey).then((response) => {
-      if (!response.ok) throw new Error(`No public key at ${this.config.urls.publicKey}`);
+      if (!response.ok)
+        throw new Error(`No public key at ${this.config.urls.publicKey}`);
       return response.text();
-    }).then((pem) => crypto.subtle.importKey("spki", pemToDer(pem), "Ed25519", false, ["verify"])).catch((error) => {
+    }).then(
+      (pem) => crypto.subtle.importKey("spki", pemToDer(pem), "Ed25519", false, [
+        "verify"
+      ])
+    ).catch((error) => {
       this.publicKey = void 0;
       throw error;
     });
@@ -162,7 +177,8 @@ var AnswerError = class extends Error {
 };
 function toScreenResult(action, response) {
   const { result, ...answer } = response;
-  if (result === "SUCCESS") return { action, result: "SUCCESS", answer };
+  if (result === "SUCCESS")
+    return { action, result: "SUCCESS", answer };
   return { action, result: result === "FAILURE" ? "FAILURE" : "CANCELLED" };
 }
 function base64Encode(text) {
@@ -178,7 +194,11 @@ function readRawQuery(url) {
   const params = /* @__PURE__ */ new Map();
   for (const pair of url.search.slice(1).split("&")) {
     const index = pair.indexOf("=");
-    if (index > 0) params.set(pair.slice(0, index), decodeURIComponent(pair.slice(index + 1)));
+    if (index > 0)
+      params.set(
+        pair.slice(0, index),
+        decodeURIComponent(pair.slice(index + 1))
+      );
   }
   return params;
 }
@@ -192,7 +212,8 @@ function createHandler(parts) {
     const url = new URL(request.url);
     if (!url.pathname.startsWith(config.basePath)) return notFound();
     const route = url.pathname.slice(config.basePath.length) || "/";
-    if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+    if (request.method !== "GET")
+      return new Response("Method not allowed", { status: 405 });
     const host = request.headers.get("host");
     const appHost = new URL(config.appUrl).host;
     if (host && host !== appHost && (route === ROUTES.signIn || route === ROUTES.open)) {
@@ -205,8 +226,12 @@ function createHandler(parts) {
       response = await routeRequest(route, url, data, parts, { request, req });
     } catch (error) {
       const isRefusedAnswer = error instanceof AnswerError;
-      if (!isRefusedAnswer) console.error(`Clearly.HUB: ${route} failed:`, error);
-      response = errorPage(isRefusedAnswer ? 400 : 500, describeError(error));
+      if (!isRefusedAnswer)
+        console.error(`Clearly.HUB: ${route} failed:`, error);
+      response = isRefusedAnswer ? errorPage(400, error.message) : errorPage(
+        500,
+        config.isSecure ? "Something went wrong with Clearly.HUB. Please try again." : describeError(error)
+      );
     }
     if (JSON.stringify(data) !== before) {
       for (const cookie of await sessions.write(data, chunkCount)) {
@@ -223,7 +248,8 @@ async function routeRequest(route, url, session, parts, incoming) {
     case ROUTES.callback:
       return finishSignIn(url, session, parts, incoming);
     case ROUTES.signOut:
-      for (const key of Object.keys(session)) delete session[key];
+      for (const key of Object.keys(session))
+        delete session[key];
       return redirect(parts.signIn.signOutUrl());
     case ROUTES.session:
       return json(await readSession(session, parts));
@@ -236,12 +262,16 @@ async function routeRequest(route, url, session, parts, incoming) {
       delete session.result;
       return json(result);
     }
+    case ROUTES.token:
+      return readToken(session, parts);
     default:
       return notFound();
   }
 }
 async function startSignIn(url, session, { config, signIn }) {
-  const { url: authorizationUrl, pending } = await signIn.start(safeReturnTo(url, config));
+  const { url: authorizationUrl, pending } = await signIn.start(
+    safeReturnTo(url, config)
+  );
   session.signIn = pending;
   return redirect(authorizationUrl);
 }
@@ -255,13 +285,28 @@ async function finishSignIn(url, session, { config, signIn }, incoming) {
   const { appUserId, redirectTo } = typeof decision === "string" ? { appUserId: decision, redirectTo: void 0 } : decision ?? {};
   session.user = { ...person, appUserId };
   session.tokens = tokens;
-  return redirect(`${config.appUrl}${safePath(redirectTo, config) ?? pending.returnTo}`);
+  return redirect(
+    `${config.appUrl}${safePath(redirectTo, config) ?? pending.returnTo}`
+  );
 }
 async function readSession(session, parts) {
   const accessToken = await getFreshAccessToken(session, parts);
   if (!session.user || !accessToken) return { signedIn: false };
   return { signedIn: true, user: session.user };
 }
+async function readToken(session, parts) {
+  const accessToken = await getFreshAccessToken(session, parts);
+  if (!session.user || !accessToken)
+    return json({ error: "Nobody is signed in with Clearly.HUB" }, 401);
+  const token = {
+    accessToken,
+    expiresIn: Math.max(
+      0,
+      session.tokens.expiresAt - Math.floor(Date.now() / 1e3)
+    )
+  };
+  return json(token);
+}
 async function getFreshAccessToken(session, { signIn }) {
   const tokens = session.tokens;
   if (!tokens) return void 0;
@@ -278,7 +323,8 @@ async function getFreshAccessToken(session, { signIn }) {
 }
 function openScreen(url, session, { config, screens }) {
   const action = url.searchParams.get("action");
-  if (!isScreenAction(action)) return errorPage(400, `Unknown screen: ${action}`);
+  if (!isScreenAction(action))
+    return errorPage(400, `Unknown screen: ${action}`);
   const display = url.searchParams.get("display") === "redirect" ? "redirect" : "popup";
   const dataParam = url.searchParams.get("data");
   let data;
@@ -303,15 +349,21 @@ function openScreen(url, session, { config, screens }) {
 }
 async function receiveAnswer(url, session, { config, screens }, incoming) {
   const query = readRawQuery(url);
-  const { state, response } = await screens.readAnswer(
+  const { request, response } = await screens.readAnswer(
     query.get("data") ?? "",
     query.get("signature") ?? ""
   );
+  const state = request.state;
   const pending = state ? session.screens?.[state] : void 0;
   if (!pending || Date.now() - pending.createdAt > SCREEN_TTL_MS) {
-    throw new AnswerError("This answer does not belong to a screen opened in this browser");
+    throw new AnswerError(
+      "This answer does not belong to a screen opened in this browser"
+    );
   }
   delete session.screens[state];
+  if (request.client_id !== config.clientId || request.redirect_url !== screens.answerUrl || request.actions?.length !== 1 || request.actions[0] !== pending.action) {
+    throw new AnswerError("This answer was given to another app or screen");
+  }
   let result = toScreenResult(pending.action, response);
   try {
     const app = await config.onAnswer?.(result, {
@@ -321,7 +373,11 @@ async function receiveAnswer(url, session, { config, screens }, incoming) {
     });
     if (app !== void 0) result = { ...result, app };
   } catch (error) {
-    result = { action: pending.action, result: "FAILURE", error: error.message };
+    result = {
+      action: pending.action,
+      result: "FAILURE",
+      error: error.message
+    };
   }
   if (pending.display === "redirect") {
     session.result = { ref: pending.ref, result };
@@ -356,11 +412,21 @@ function safePath(path, config) {
   }
 }
 var redirect = (location) => new Response(null, { status: 302, headers: { Location: location } });
-var json = (body) => new Response(JSON.stringify(body), {
-  headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+var json = (body, status = 200) => new Response(JSON.stringify(body), {
+  status,
+  headers: {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  }
+});
+var html = (body, status = 200) => new Response(body, {
+  status,
+  headers: { "Content-Type": "text/html; charset=utf-8" }
+});
+var notFound = () => new Response("Not found", {
+  status: 404,
+  headers: { "X-Clearly-Hub": "unhandled" }
 });
-var html = (body, status = 200) => new Response(body, { status, headers: { "Content-Type": "text/html; charset=utf-8" } });
-var notFound = () => new Response("Not found", { status: 404, headers: { "X-Clearly-Hub": "unhandled" } });
 function describeError(error) {
   const messages = [];
   for (let current = error; current instanceof Error && messages.length < 5; current = current.cause) {
@@ -369,7 +435,10 @@ function describeError(error) {
   return messages.join(": ") || String(error);
 }
 function errorPage(status, message) {
-  const escaped = message.replace(/[&<>"]/g, (char) => `&#${char.charCodeAt(0)};`);
+  const escaped = message.replace(
+    /[&<>"]/g,
+    (char) => `&#${char.charCodeAt(0)};`
+  );
   return html(
     `<!doctype html><meta charset="utf-8"><title>Clearly.HUB</title><p>${escaped}</p>`,
     status
@@ -391,7 +460,9 @@ var HubApi = class {
     try {
       return await this.config.fetch(url, init);
     } catch (error) {
-      throw new Error(`Clearly.HUB could not be reached at ${url}`, { cause: error });
+      throw new Error(`Clearly.HUB could not be reached at ${url}`, {
+        cause: error
+      });
     }
   }
   get hasAppKey() {
@@ -401,11 +472,16 @@ var HubApi = class {
   // until shortly before it expires
   async getAppToken() {
     const now = Date.now() / 1e3;
-    if (this.appToken && this.appToken.expiresAt > now + 60) return this.appToken.value;
+    if (this.appToken && this.appToken.expiresAt > now + 60)
+      return this.appToken.value;
     if (!this.hasAppKey) {
-      throw new Error("Clearly.HUB: m2mClientId and m2mClientSecret are needed for this");
+      throw new Error(
+        "Clearly.HUB: m2mClientId and m2mClientSecret are needed for this"
+      );
     }
-    const credentials = btoa(`${this.config.m2mClientId}:${this.config.m2mClientSecret}`);
+    const credentials = btoa(
+      `${this.config.m2mClientId}:${this.config.m2mClientSecret}`
+    );
     const response = await this.call(`${this.config.urls.auth}/oauth2/token`, {
       method: "POST",
       headers: {
@@ -421,7 +497,10 @@ var HubApi = class {
       throw new Error(`Clearly.HUB refused the app's key (${response.status})`);
     }
     const body = await response.json();
-    this.appToken = { value: body.access_token, expiresAt: now + body.expires_in };
+    this.appToken = {
+      value: body.access_token,
+      expiresAt: now + body.expires_in
+    };
     return body.access_token;
   }
   // Every hub that bought your app, with status and your plan id
@@ -429,11 +508,16 @@ var HubApi = class {
     if (this.subscriptions && Date.now() - this.subscriptions.fetchedAt < SUBSCRIPTIONS_CACHE_MS) {
       return this.subscriptions.value;
     }
-    const response = await this.call(`${this.config.urls.api}/api/app-api/subscriptions`, {
-      headers: { Authorization: `Bearer ${await this.getAppToken()}` }
-    });
+    const response = await this.call(
+      `${this.config.urls.api}/api/app-api/subscriptions`,
+      {
+        headers: { Authorization: `Bearer ${await this.getAppToken()}` }
+      }
+    );
     if (!response.ok) {
-      throw new Error(`Could not read the subscriptions from Clearly.HUB (${response.status})`);
+      throw new Error(
+        `Could not read the subscriptions from Clearly.HUB (${response.status})`
+      );
     }
     const items = await response.json();
     const value = items.map((item) => ({
@@ -466,12 +550,16 @@ var HubApi = class {
     });
     if (!response.ok) {
       const body = await response.json().catch(() => ({}));
-      throw new Error(`Clearly.HUB did not accept the usage: ${body.message ?? response.status}`);
+      throw new Error(
+        `Clearly.HUB did not accept the usage: ${body.message ?? response.status}`
+      );
     }
   }
 };
 function pickSubscription(subscriptions, hubId) {
-  const ofHub = subscriptions.filter((subscription) => subscription.hubId === hubId);
+  const ofHub = subscriptions.filter(
+    (subscription) => subscription.hubId === hubId
+  );
   return ofHub.find((s) => s.status === "ACTIVE") ?? ofHub.find((s) => s.status === "PENDING");
 }
 
@@ -488,7 +576,12 @@ var SignIn = class {
   }
   // Discovery happens once, on the first sign-in
   getConfiguration() {
-    this.configuration ??= oidc.discovery(new URL(this.config.urls.issuer), this.config.clientId, void 0, oidc.None()).catch((error) => {
+    this.configuration ??= oidc.discovery(
+      new URL(this.config.urls.issuer),
+      this.config.clientId,
+      void 0,
+      oidc.None()
+    ).catch((error) => {
       this.configuration = void 0;
       throw error;
     });
@@ -510,11 +603,15 @@ var SignIn = class {
     return { url: url.href, pending: { codeVerifier, state, nonce, returnTo } };
   }
   async finish(currentUrl, pending) {
-    const tokens = await oidc.authorizationCodeGrant(await this.getConfiguration(), currentUrl, {
-      pkceCodeVerifier: pending.codeVerifier,
-      expectedState: pending.state,
-      expectedNonce: pending.nonce
-    });
+    const tokens = await oidc.authorizationCodeGrant(
+      await this.getConfiguration(),
+      currentUrl,
+      {
+        pkceCodeVerifier: pending.codeVerifier,
+        expectedState: pending.state,
+        expectedNonce: pending.nonce
+      }
+    );
     const claims = tokens.claims();
     if (!claims) throw new Error("Clearly.HUB sent no ID token");
     return {
@@ -527,7 +624,10 @@ var SignIn = class {
     };
   }
   async refresh(refreshToken) {
-    const tokens = await oidc.refreshTokenGrant(await this.getConfiguration(), refreshToken);
+    const tokens = await oidc.refreshTokenGrant(
+      await this.getConfiguration(),
+      refreshToken
+    );
     return toSessionTokens(tokens, refreshToken);
   }
   // Signing out of Clearly.HUB too, or the next sign-in goes straight through
@@ -560,12 +660,16 @@ function parseCookies(header) {
   const cookies = /* @__PURE__ */ new Map();
   for (const part of header.split(";")) {
     const index = part.indexOf("=");
-    if (index > 0) cookies.set(part.slice(0, index).trim(), part.slice(index + 1).trim());
+    if (index > 0)
+      cookies.set(part.slice(0, index).trim(), part.slice(index + 1).trim());
   }
   return cookies;
 }
 async function deriveKey(secret) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
   return new Uint8Array(digest);
 }
 var SessionStore = class {
@@ -583,8 +687,14 @@ var SessionStore = class {
     }
     if (!chunks.length) return { data: {}, chunkCount: 0 };
     try {
-      const { plaintext } = await compactDecrypt(chunks.join(""), await this.keyPromise);
-      return { data: JSON.parse(new TextDecoder().decode(plaintext)), chunkCount: chunks.length };
+      const { plaintext } = await compactDecrypt(
+        chunks.join(""),
+        await this.keyPromise
+      );
+      return {
+        data: JSON.parse(new TextDecoder().decode(plaintext)),
+        chunkCount: chunks.length
+      };
     } catch {
       return { data: {}, chunkCount: chunks.length };
     }
@@ -592,7 +702,9 @@ var SessionStore = class {
   // Set-Cookie headers for the new session, clearing chunks it no longer needs
   async write(data, previousChunkCount) {
     const isEmpty = Object.keys(data).length === 0;
-    const chunks = isEmpty ? [] : (await this.encrypt(data)).match(new RegExp(`.{1,${CHUNK_SIZE}}`, "g"));
+    const chunks = isEmpty ? [] : (await this.encrypt(data)).match(
+      new RegExp(`.{1,${CHUNK_SIZE}}`, "g")
+    );
     const attributes = `Path=/; HttpOnly; SameSite=Lax${this.config.isSecure ? "; Secure" : ""}`;
     const headers = chunks.map(
       (chunk, i) => `${COOKIE_NAME}.${i}=${chunk}; Max-Age=${MAX_AGE_SECONDS}; ${attributes}`
@@ -639,10 +751,17 @@ function clearlyHub(options) {
     },
     getUserToken,
     // Fetch protected or paid data (for example from DATA_PICKER) with the
-    // person's key. Open data works without it.
+    // person's key. Open data works without it. Only URLs on Clearly.HUB's
+    // data proxy: the key would let anyone else act as this person
     async fetchAsUser(request, url, init = {}) {
+      if (!isOnProxy(url, config.urls.proxy)) {
+        throw new Error(
+          `Clearly.HUB: fetchAsUser only sends the person's key to Clearly.HUB's data proxy (${config.urls.proxy}, set with urls.proxy), not to ${url}`
+        );
+      }
       const token = await getUserToken(request);
-      if (!token) throw new Error("Clearly.HUB: nobody is signed in with Clearly.HUB");
+      if (!token)
+        throw new Error("Clearly.HUB: nobody is signed in with Clearly.HUB");
       const headers = new Headers(init.headers);
       headers.set("Authorization", token);
       return config.fetch(url, { ...init, headers });
@@ -667,11 +786,18 @@ function clearlyHub(options) {
     }) {
       const person = sub ?? (request && (await parts.sessions.read(request)).data.user?.sub);
       if (!person) {
-        throw new Error("Clearly.HUB: reportUsage needs the sub of a Clearly.HUB account");
+        throw new Error(
+          "Clearly.HUB: reportUsage needs the sub of a Clearly.HUB account"
+        );
       }
-      const subscription = pickSubscription(await parts.api.getSubscriptions(), hubId);
+      const subscription = pickSubscription(
+        await parts.api.getSubscriptions(),
+        hubId
+      );
       if (subscription?.status !== "ACTIVE") {
-        throw new Error(`Clearly.HUB: hub ${hubId} has no active subscription to your app`);
+        throw new Error(
+          `Clearly.HUB: hub ${hubId} has no active subscription to your app`
+        );
       }
       await parts.api.reportUsage({
         sub: person,
@@ -682,6 +808,15 @@ function clearlyHub(options) {
     }
   };
 }
+function isOnProxy(url, proxy) {
+  try {
+    const target = new URL(url);
+    const base = new URL(`${proxy}/`);
+    return target.origin === base.origin && target.pathname.startsWith(base.pathname);
+  } catch {
+    return false;
+  }
+}
 export {
   clearlyHub
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clearly-hub/node",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Clearly.HUB for Node servers: sign-in, hosted screens, subscriptions and usage in one handler",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Future Insight Group BV",